DR. DAVID F. RICO, PMP, CSEP, EBAS, BAF, FCP, FCT, ACP, CSM, SAFE, DEVOPS, AWSWebsite: http://davidfrico.com ● LinkedIn: http://linkedin.com/in/davidfrico ● Twitter: @dr_david_f_rico

Agile Cost of Quality: http://www.davidfrico.com/agile-vs-trad-coq.pdfDevOps Return on Investment (ROI): http://davidfrico.com/rico-devops-roi.pdf

Dave’s NEW Business Agility Video: http://www.youtube.com/watch?v=hTvtsAkL8xUDave’s NEWER Scaled Agile Framework SAFe 4.5 Video: http://youtu.be/1TAuCRq5a34

Dave’s NEWEST Development Operations Security Video: http://youtu.be/qrWRoXSS9bsDave’s BRAND-NEW ROI of Lean Thinking Principles Video: http://youtu.be/wkMfaPAxO6E

Dave’s REALLY-NEW ROI of Evolutionary Design Principles Video: http://youtu.be/TcXI26ClRb0Dave’s EXTREMELY-NEW ROI of Organizational Agility Principles Video: http://youtu.be/HOzDM5krtes

DoD Fighter Jets versus Amazon Web Services: http://davidfrico.com/dod-agile-principles.pdfPrinciples of Collaborative Contracts: http://davidfrico.com/collaborative-contract-principles.pdf

Principles of Lean Organizational Leadership: http://davidfrico.com/lean-leadership-principles.pdfPrinciples of Evolutionary Architecture: http://davidfrico.com/evolutionary-architecture-principles.pdfPrinciples of CI, CD, & DevOps - Development Operations: http://davidfrico.com/devops-principles.pdfPrinciples of SAFe Transformations - Scaled Agile Framework: http://davidfrico.com/safe-principles.pdf

Principles of Maximizing SAFe ROI - Scaled Agile Framework: http://davidfrico.com/safe-roi-principles.pdfPrinciples of Lean-Agile - Contract Statements of Work (SOW): http://davidfrico.com/agile-sow-principles.pdf

Economic Value of Agile Businesses, Enterprises & Organizations - http://davidfrico.com/value-of-business-agility.pdf

Business Value ofCI, CD, & DevOpsSec

Scaling Up to Billion User Global Systems of Systems Using Containerized Microservices

Author Background Gov’t contractor with 39+ years of IT experience B.S. Comp. Sci., M.S. Soft. Eng., & D.M. Info. Sys. Large gov’t projects in U.S., Far/Mid-East, & Europe

2

Career IT project management, systems and software engineering PROCESS coach. Supported numerous billion-dollar enterprise digital transformation initiatives for 35+ years. Clients multi-billion government agencies, Fortune 500 conglomerates, and international IT firms. Included NASA's Space Station, Japanese Firms, Navy Fighters, NRO Satellites, and Intel Clouds, etc. Supported Digital Transformations at leading energy, healthcare, financial, and DoD enterprises and firms. Supported virtual casefile systems, data warehouses, data lakes, cloud migrations, and enterprise architectures. Specialized in Lean, Agile, Scrum, Scaled Agile Framework (SAFe), CI, CD, DevOps, DevSecOps, and Cloud Computing. Quickstart SAFe rollouts for critical portfolios, solutions, programs, projects, and new product development initiatives. Provides one-on-one and small group coaching services for C-levels, directors, managers, tech leaders, and developers. Skills include Lean, Agile, Scrum, SAFe, DevSecOps, Agile assessments, metrics, toolsets, dashboards, and case studies. Public speaker, author, blogger, trainer and holds over 13 professional certifications including SAFe SPC 5.0 and AWS CCP. Supported HHS, CMS, IRS, Exelon, ODNI IC-CIO, Intel, DoD, DoJ, USPS, NASA, DARPA, DISA, U.S. Air Force, Army, and Navy.

3

Internet of Things—Dinosaur Killer

IoT is an Extinction Level Event• 25-50B Devices on IOT• 5-10B Internet Hosts• 4-8B Mobile Phones• 2-3B End User Sys• Mass Business Failure

Dev-Ops (dĕv′ŏps) Early, iterative, & automated combo of development & operations; Incremental deployment An approach embracing principles & values of lean

thinking, product development flow, & agile methods Early, collaborative, and automated form of incremental

development, integration, system, & operational testing Design method that supports collaboration, teamwork,

iterative development, & responding to change Multi-tiered automated framework for TDD, Continuous

Integration, BDD, Continuous Delivery, & DevOps Maximizes BUSINESS VALUE of organizations, portfolios,

& projects by enabling buyers-suppliers to scale globally

4

Crispin, L., & Gregory, J. (2009). Agile testing: A practical guide for testers and agile teams. Boston, MA: Addison-Wesley.Crispin, L., & Gregory, J. (2015). More agile testing: Learning journeys for the whole team. Boston, MA: Addison-Wesley.

DevOps—What is it?

NetworkComputer

Operating SystemMiddlewareApplications

APIsGUI

Agile requirements implemented in slices vs. layers User needs with higher business value are done first Reduces cost & risk while increasing business success

5Shore, J. (2011). Evolutionary design illustrated. Norwegian Developers Conference, Oslo, Norway.

Agile Traditional1 2 3• Faster

• Early ROI

• Lower Costs

• Fewer Defects

• Manageable Risk

• Better Performance

• Smaller Attack Surface

Late •

No Value •

Cost Overruns •

Very Poor Quality •

Uncontrollable Risk •

Slowest Performance •

More Security Incidents •Seven Wastes1. Rework2. Motion3. Waiting4. Inventory5. Transportation6. Overprocessing7. Overproduction

MINIMIZES MAXIMIZES

• JIT, Just-enough architecture• Early, in-process system V&V• Fast continuous improvement• Scalable to systems of systems• Maximizes successful outcomes

• Myth of perfect architecture• Late big-bang integration tests• Year long improvement cycles• Breaks down on large projects• Undermines business success

DevOps—How it works?

6

Traditional vs. Agile Cumulative Flow

Wor

k (S

tory

, Poi

nt, T

ask)

or E

ffor

t (W

eek,

Day

, Hou

r)

Time Unit (Roadmap, Release, Iteration, Month, Week, Day, Hour, etc.)

Wor

k (S

tory

, Poi

nt, T

ask)

or E

ffor

t (W

eek,

Day

, Hou

r)

Time Unit (Roadmap, Release, Iteration, Month, Week, Day, Hour, etc.)

TRADITIONAL Cumulative Flow

Late big bang integration increases WIP backlog Agile testing early and often reduces WIP backlog Improves workflow and reduces WIP & lead times

Anderson, D. J. (2004). Agile management for software engineering. Upper Saddle River, NJ: Pearson Education.Anderson, D. J. (2010). Kanban: Successful evolutionary change for your technology business. Sequim, WA: Blue Hole Press.

DevOps—Workflow Results

DEVOPS Cumulative Flow

7

Methods to “scope” project, product, or system “Key” is smallest possible scope with highest value Reduces cost, risk, time, failure, & tech. obsolescence

INCREASES TESTABILITY, QUALITY, RELIABILITY, SECURITY, MORALE, MAINTAINABILITY, & SUCCESS

Denne, M., & Cleland-Huang, J. (2004). Software by numbers: Low-risk, high-return development. Santa Clara, CA: Sun Microsystems.Ries, E. (2011). The lean startup: How today's entrepreneurs use continuous innovation. New York, NY: Crown Publishing.Patton, J. (2014). User story mapping: Discover the whole story, build the right product. Sebastopol, CA: O'Reilly Media.Layton, M. C., & Maurer, R. (2011). Agile project management for dummies. Hoboken, NJ: Wiley Publishing.Krause, L. (2014). Microservices: Patterns and applications. Paris, France: Lucas Krause.

MINIMUM

MARKETABLE FEATURE- MMF -

AdvantageDifferenceRevenueProfitSavingsBrandLoyalty

MINIMUMVIABLE PRODUCT

- MVP -GoalProcessFeaturesPrioritiesStory MapArchitecture

STORY MAPOR IMPACT MAP

- SM or IM -GoalActors ImpactsDeliverablesMeasuresMilestones

VISIONSTATEMENT

- VS -For <customer>Who <needs it>The <product> Is a <benefit>That <customer>Unlike <other>Ours <different>

MICRO-SERVICE- MS -

PurposeAutomatedUnique IndependentResilientEcosystemConsumer

DevOps—MMF, MVP, MVA, etc.

8

Lightweight, fast, disposable virtual environments Set of isolated processes running on shared kernel Efficient way for building, delivering, & running apps

Monolithic Applications Just-Enough Applications Containerized Apps

Minimal - Typically single process entitiesDeclarative - Built from layered Docker imagesImmutable - Do exactly same thing from run to kill

• Small autonomous services that work together• Self-contained process that provides a unique capability

• Loosely coupled service oriented architecture with bounded contexts• Small independent processes communicating with each other using language-agnostic APIs

• Fined-grained independent services running in their own processes that are developed and deployed independently• Suite of services running in their own process, exposing APIs, and doing one thing well (independently developed and deployable)

• Single app as a suite of small services, each running in its own process and communicating with lightweight mechanisms (HTTP APIs)

Krause, L. (2014). Microservices: Patterns and applications. Paris, France: Lucas Krause.

DevOps—Microservices

OS’s HaveUNREPORTED

30-50 CVEs

9Rix, M. (2019). Conquering the monolith: Architecting for DevOps and release on demand. SAFe Summit Europe, Hague, Netherlands.Newman, S. (2019). Monolith to microservices: Evolutionary patterns to transform your monolith. Sebastopol, CA: O'Reilly.

DevOps—Monolith to MicroservicesDOMAIN DRIVEN DESIGN

Aligned to Business Better Organized Shared Libraries Fewer Dependencies Portable/Changeable Faster Testing Enables Scaled Agile Teams

SERVICE-BASED ARCHITECTURE

Separately Deployable Systems Shared Database per System Decoupled Business Systems Fewer Defects/Breaking BugsMore Development OptionsMore Infrastructure Options Enables Small Agile Teams

MICROSERVICE ARCHITECTURE

Decoupled Business Functions Local Database per Service Separately Deployable Services CI, CD, and Fast Deployments Release on Demand/Fast Recovery Container Ready and Cloud Ready Enables Tiny Two-Pizza Teams

• Reverse Conway's Law• Use Strangler Application Pattern

• Test Within Domains (vs. Across Domains)• Avoid Canonical and Master Data Definitions

• Not All Monoliths Are Evil (However, Most Are)• Plan to Re-Architect in Five Years (Moore's Law)

• Lean-Agile practices rarely scale to high-risk solutions

10

TDD

- 2003 -CI

- 2006 -BDD

- 2008 -CD

- 2011 -DEVOPS

- 2012 -DEVOPSSEC- 2014 -

•User Story

•Acc Criteria

•Dev Unit Test

•Run Unit Test

•Write SW Unit

•Re-Run Unit Test

•Refactor Unit

•Building

•Database

• Inspections

•Testing

• Feedback

•Documentation

•Deployment

•Analyze Feature

•Acc Criteria

•Dev Feat. Test

•Run Feat. Test

•Develop Feature

•Re-Run Feature

•Refactor Feat.

•Packaging

•Acceptance

• Load Test

•Performance

•Pre-Production

•Certification

•Deployment

•Sys Admin

•Config. Mgt.

•Host Builds

•Virtualization

•Containerization

•Deployment

•Monitor & Supp

•Sec. Engineer.

•Sec. Containers

•Sec. Evaluation

•Sec. Deploy.

•Runtime Prot.

•Sec. Monitoring

•Response Mgt.

Beck, K. (2003). Test-driven development: By example. Boston, MA: Addison-Wesley.Duvall, P., Matyas, S., & Glover, A. (2006). Continuous integration. Boston, MA: Addison-Wesley.Barker, K., & Humphries, C. (2008). Foundations of rspec: Behavior driven development with ruby and rails. New York, NY: Apress.Humble, J., & Farley, D. (2011). Continuous delivery. Boston, MA: Pearson Education.Huttermann, M. (2012). Devops for developers: Integrate development and operations the agile way. New York, NY: Apress.Bird, J. (2016). Devopssec: Delivering secure software through continuous delivery. Sebastopol, CA: O'Reilly Media.

Numerous models of lean-agile testing emerging Based on principles of lean & agile one piece flow Include software, hardware, system, & port. testing

DevOps—Evolution

STAGE 1—Test Driven Development Term coined by Kent Beck in 2003 Consists of writing all tests before design Ensures all components are verified and validated

11Beck, K. (2003). Test-driven development: By example. Boston, MA: Addison-Wesley.

Agile TDD consists of seven broad practices Document test criteria, tests, software units, etc. Include refactoring, verification, optimization, etc.

12

PracticeUser Story

Acc Criteria

Dev Test

Run Test

Dev Unit

Rerun Test

Refactor Unit

DescriptionRead story, analyze meaning, ask questions, and clarify understanding

Identify, verify, and document acceptance criteria for each user story

Design, develop, code, and verify automated unit test for user story

Run automated unit test to verify that it fails the first time (sanity check)

Design, develop, code, and verify the software unit to satisfy user story

Rerun automated unit test to see if code satisfies automated unit test

Refine, reduce, and simplify code to remove waste and optimize performance

STAGE 1—Test Driven Develop.

Beck, K. (2003). Test-driven development: By example. Boston, MA: Addison-Wesley.

STAGE 2—Behavior Driven Develop. Term coined by Dan North in 2006 Consists of writing feature tests before design Ensures all system features are verified and validated

13Smart, J. F. (2014). BDD in action: Behavior-driven development for the whole software lifecycle. Shelter Island, NY: Manning Publications.

Agile BDD consists of seven broad practices Document test criteria, tests, syst. features, etc. Include refactoring, verification, optimization, etc.

14

PracticeFeature

Acc Criteria

Dev Test

Run Test

Dev Feature

Rerun Test

Refac Feature

DescriptionRead feature, analyze meaning, ask questions, and clarify understanding

Identify, verify, and document acceptance criteria for each feature

Design, develop, code, and verify automated feature test for feature

Run automated feature test to verify that it fails the first time (sanity check)

Design, develop, code, and verify the feature software to satisfy feature

Rerun automated feature test to see if code satisfies automated feature test

Refine, reduce, and simplify code to remove waste and optimize performance

STAGE 2—Behavior Driven Dev.

Smart, J. F. (2014). BDD in action: Behavior-driven development for the whole software lifecycle. Shelter Island, NY: Manning Publications.

Term coined by Martin Fowler circa 1998 User needs designed & developed one-at-a-time Changes automatically detected, built, & fully-tested

15Humble, J., & Farley, D. (2011). Continuous delivery. Boston, MA: Pearson Education.Duvall, P., Matyas, S., & Glover, A. (2006). Continuous integration. Boston, MA: Addison-Wesley.

STAGE 3—Continuous Integration

Thousands of TestsContinuously Executed

No More Late BigBang Integration

BuildIntegration

Server

VersionControlServer

BuildScripts

UsesWatches

BuildStatus

ProvidesDeveloper A

Developer B

Developer C

CommitsChanges

CommitsChanges

CommitsChanges

BuildsDatabaseAnalysisTestingReportingDocumentationDeployment

Early, Automated, Fast,Efficient, & Repeatable

Constant ReadinessState & CM Control

Lean, Waste Free, Low WIP,No Deadlocked Test Queues

Rapidly & SuccessfullyDev. Complex Systems

ALL DEVELOPERS RUN PRIVATE BUILDS

DEVELOPERS COMMIT CODE TO VERSION CONTROL

INTEGRATION BUILDS OCCUR SEVERAL TIMES PER DAY

100% OF SYSTEM TESTS MUST PASS FOR EVERY BUILD

A SHIPPABLE PRODUCT RESULTS FROM EVERY BUILD

FIXING BROKEN BUILDS IS OF THE HIGHEST PRIORITY

REPORTS AUTOMATICALLY GENERATED & REVIEWED

Agile CI consists of seven broad practices Automated build, database, inspection, tests, etc. Include reporting, documentation, deployment, etc.

16

PracticeBuilding

Database

Inspections

Testing

Feedback

Documentation

Deployment

DescriptionFrequently assembling products and services to ensure delivery readiness

Frequently generating/analyzing database schemas, queries, and forms

Frequently performing automated static analysis of product/service quality

Frequently performing automated dynamic product and service evaluation

Frequently generating automated status reports/messages for all stakeholders

Frequently performing automated technical/customer document generation

Frequently performing automated delivery of products/services to end users

Duvall, P., Matyas, S., & Glover, A. (2006). Continuous integration: Improving software quality and reducing risk. Boston, MA: Addison-Wesley.Humble, J., & Farley, D. (2011). Continuous delivery. Boston, MA: Pearson Education.

STAGE 3—Continuous Integration

Created by Jez Humble of ThoughtWorks in 2011 Includes CM, build, testing, integration, release, etc. Goal is one-touch automation of deployment pipeline

17Humble, J., & Farley, D. (2011). Continuous delivery. Boston, MA: Pearson Education.Duvall, P., Matyas, S., & Glover, A. (2006). Continuous integration. Boston, MA: Addison-Wesley.Ohara, D. (2012). Continuous delivery and the world of devops. San Francisco, CA: GigaOM Pro.

CoQ

• 80% MS Tst• 8/10 No Val• $24B in 90s• Rep by CD• Not Add MLK

STAGE 4—Continuous Delivery

Source CodeControl

BuildAutomation

TestAutomation

ContinuousIntegration

ReleaseAutomation

ContinuousDelivery

Agile CD consists of seven broad practices Automated acceptance, load, performance, etc. Include packaging, pre-production test, C&A, etc.

18

PracticePackaging

Acceptance

Load Test

Performance

Pre-Production

Certification

Deployment

DescriptionFrequently generating system images for pre-production testing & checkout

Frequently performing automated system & user acceptance testing

Frequently performing automated system load, stress, & capacity testing

Frequently performing automated system user & technical performance testing

Frequently performing automated pre-production tests prior to final deployment

Frequently performing automated system certification & accreditation tests

Frequently generating product images for pre-deployment testing & checkout

Mukherjee, J. (2015). Continuous delivery pipeline: Where does it choke. Charleston, SC: CreateSpace.Swartout, P. (2014). Continuous delivery and devops: A quickstart guide. Birmingham, UK: Packt Publishing.

STAGE 4—Continuous Delivery

Created by Patrick Debois of Jedi BVBA in 2007 Collaboration of developers & infrastructure people Goal to automate the deployment to end-user devices

19Bass, L., Weber, I., & Zhu, L. (2015). Devops: A software architect's perspective. Old Tappan, NJ: Pearson Education.Gruver, G., & Mouser, T. (2015). Leading the transformation: Applying agile and devops at scale. Portland, OR: IT Revolution Press.Humble, J., Molesky, J., & O'Reilly, B. (2015). Lean enterprise: How high performance organizations innovate at scale. Sebastopol, CA: O'Reilly Media.

STAGE 5—Development Operations

Collaboration

Agile DevOps consists of seven broad practices Automated sys admin, CM, building, monitor, etc. Include virtualization, containerize, deployment, etc.

20

PracticeSys Admin

Config. Mgt.

Host Builds

Virtualization

Containerize

Deployment

Monitor & Supp

DescriptionFrequently performing automated system administration tasks, i.e., scripting

Frequently performing automated infrastructure config. mgt./version control

Frequently performing automated system and server host builds and config.

Frequently performing automated system, server, & net virtualization services

Frequently performing automated software and Microservices containerization

Frequently generating final end-user system & software images for distribution

Frequently performing automated metrics collection & deployment monitoring

Duffy, M. (2015). Devops automation cookbook: Over 120 recipes coverying key automation techniques. Birmingham, UK: Packt Publishing.Farcic, V. (2016). The devops 2.0 toolkit: Automating the continuous deployment pipelines with containerized microservices. Victoria, CA: LeanPub.

STAGE 5—Development Operations

STAGE 6—Development Ops Sec DevOpsSec coined by Shannon Lietz in 2014 Rugged devops, devsecops, secdevops, devopssec Microservices, security engineering & operations keysSecure Microservices

• Docker App• Docker Bins• Docker Files• Docker Images• Docker Scanning• Docker Registry• Docker Host• Docker Hub• Docker Monitoring

Secure Engineering• Security Champions• Security Planning• Security Training• Security Requirements• Security Architecture• Security Analysis• Security Testing• Security Review• Security Response

Secure Operations• Activity Logging• Event Monitoring• Configuration Mgt.

• Patch Management• User Access Control• Privilege Management

• Vulnerability Mgt.• Response Mgt.• Performance Mgt.

Bird, J. (2016). Devopssec: Delivering secure software through continuous delivery. Sebastopol, CA: O'Reilly Media.21

DevOpsSec consists of seven broad practices Automated secure build, analysis, & deployment Includes containerization, engineering & operations

22

PracticeEngineering

Containers

Evaluation

Deployment

Protection

Monitoring

Responses

DescriptionFrequently performing “baked-in” lean and agile security engineering practices

Frequently performing automated microservices containerization practices

Frequently performing automated static and dynamic vulnerability analysis

Frequently performing automated digitally signed security deployment practices

Frequently performing automated real-time self-security protection practices

Frequently performing automated real-time security monitoring practices

Frequently performing automated trigger-based rollback response practices

Bird, J. (2016). Devopssec: Delivering secure software through continuous delivery. Sebastopol, CA: O'Reilly Media.

STAGE 6—Development Ops Sec

SE framework by Dean Leffingwell of Rally in 2007 Newest version leaner, meaner, lighter, and simpler Experimental bottoms-up DevOps-based innovation

23Leffingwell, D. (2007). Scaling software agility: Best practices for large enterprises. Boston, MA: Pearson Education.

STAGE 7—Enterprise DevOpsSec

24Juengst, D. (2015). Deliver better software faster: With the cloudbees jenkins platform. San Francisco, CA: CloudBees.Weeks, D. E. (2014). Devops and continuous delivery reference architectures (volume 1 & 2). Fulton, MD: Sonatype.

DevOps—Tools Ecosystem Numerous tools to automate DevOps pipeline People can piece together toolset along with hubs Tools include version control, testing, & deployment

25XeniaLabs. (2018). Periodic table of devops tools. Retrieved April 11, 2016, from https://xebialabs.com/periodic-table-of-devops-tools.Weeks, D. E. (2017). Devops and continuous delivery reference architectures (volume 1 & 2). Fulton, MD: Sonatype.

DevOps—Periodic Table

26Tesauro, M. (2016). Taking appsec to 11: Appsec pipelines, devops, and making things better. Denver, CO: SnowFROC 2016.Weeks, D. E. (2014). Devops and continuous delivery reference architectures (volume 1 & 2). Fulton, MD: Sonatype.

DevOps—Security Tools Ecosystem Many tools emerging for DevOps application security Begins-ends with microservices—tiny attack surface Includes containers, testing, & real-time monitoring

27

DevOps—Automation Metrics

28

Test Coverage Test Automation

Integration Builds Running Tested Features

Defects DecreaseIntegrations

Increase

IncreaseCoverage

IncreaseAutomation

Duvall, P., Matyas, S., & Glover, A. (2006). Continuous integration: Improving software quality and reducing risk. Boston, MA: Addison-Wesley.Jones, C. L., et al. (2020). Continuous Iterative Development Measurement Framework. Picatinny Arsenal, NJ: US Army ARDEC.

29

DevOps metrics gaining in widespread popularity Hybrid of development & IT operations measures Includes code, deployment & e-business analytics

Velasquez, N. F. (2014). State of devops report. Portland, OR: Puppet Labs, Inc.Jones, C. L., et al. (2020). Continuous Iterative Development Measurement Framework. Picatinny Arsenal, NJ: US Army ARDEC.

DevOps—Deployment Metrics

30

Industry leading DevOps assessments are emerging DORA Technology DevOps Assessment is popular Includes speed, deployments, reliability & morale

Kim, G., Forsgren, N., & Humble, J. (2017). The DORA technology performance assessment. Portland, OR: DevOps Research.

DevOps—Assessments

Activity Def CoQ DevOps Economics Hours ROIDevelopment Operations 100 0.001 100 Defects x 70% Efficiency x 0.001 Hours 0.070 72,900%

Continuous Delivery 30 0.01 30 Defects x 70% Efficiency x 0.01 Hours 0.210 24,300%

Continuous Integration 9 0.1 9 Defects x 70% Efficiency x 0.1 Hours 0.630 8,100%

Software Inspections 3 1 2.7 Defects x 70% Efficiency x 1 Hours 1.890 2,700%

"Traditional" Testing 0.81 10 0.81 Defects x 70% Efficiency x 10 Hours 5.670 900%

Manual Debugging 0.243 100 0.243 Defects x 70% Efficiency x 100 Hours 17.010 300%

Operations & Maintenance 0.073 1,000 0.0729 Defects x 70% Efficiency x 1,000 Hours 51.030 n/a

31

Agile testing is orders-of-magnitude more efficient Based on millions of automated tests run in seconds One-touch auto-delivery to billions of global end-users

Rico, D. F. (2016). Devops cost of quality (CoQ): Phase-based defect removal model. Retrieved May 10, 2016, from http://davidfrico.com

DevOps—Cost of Quality

Under 4Minutes

4,500 x Fasterthan Code

Inspections

32

Hewlett-Packard is a major user of CI, CD, & DevOps 400 engineers developed 10 million LOC in 4 years Major gains in testing, deployment, & innovation

Gruver, G., Young, M. & Fulghum, P. (2013). A practical approach to large-scale agile development. Upper Saddle River, NJ: Pearson Education.

TYPE METRIC MANUAL DEVOPS MAJOR GAINS

CYCLE TIMEIMPROVEMENTS

Build Time 40 Hours 3 Hours 13 xNo. Builds 1-2 per Day 10-15 per Day 8 xFeedback 1 per Day 100 per Day 100 x

Regression Testing 240 Hours 24 Hours 10 x

DEVELOPMENTCOST EFFORTDISTRIBUTION

Integration 10% 2% 5 xPlanning 20% 5% 4 xPorting 25% 15% 2 xSupport 25% 5% 5 xTesting 15% 5% 3 x

Innovation 5% 40% 8 x

DevOps—HP Case Study

Assembla went from 2 to 45 releases every month 15K Google developers run 150 million tests per day 30K+ Amazon developers deliver 136K releases a day

33Singleton, A. (2014). Unblock: A guide to the new continuous agile. Needham, MA: Assembla, Inc.

62 x FasterU.S. DoD

IT Project

3,645 x FasterU.S. DoD

IT Project

DevOps—Dot Com Case Study

34Ashman, D. (2014). Blackboard: Keep your head in the clouds. Proceedings of the 2014 Enterprise DevOps Summit, San Francisco, California, USA.

Productivity STOPS due to excessive integration Implements DevOps & Microservices around 2010 Waste elimination, productivity & innovation skyrocket

DevOps—Blackboard Case Study

DEVOPS &MICROSERVICES

IMPLEMENTED

35Denayer, L. (2017). U.S. DHS citizenship and immigration services: USCIS agile development. Washington, DC. iSDLC Seminar.

1st gen replete with large portfolios & governance 2nd-3rd gen yield minor incremental improvements 4th-5th gen enables big order-of-magnitude impacts

DevOps—U.S. DHS Case Study

Automated GovernanceManual Governance

Tesla vehicle models are all electric automobiles Tesla autos have 100-200 million lines of code Tesla performs up to 130 deployments per day

36

DevOps—Tesla Software Releases

Choksi, N. (2016). How software lifecycle integration and devops are transforming car development. Goto Conference, Copenhagen, Denmark.Vost, S., & Wagner, S. (2016). Towards continuous integration and continuous delivery in the automotive industry. Ithaca, NY: Cornell University.

37

DevOps—Various Case StudiesWHO RESULTS

1 code repository 40,000 commits per day 50,000 builds per day 150 million tests per day

24-day average server age 1 billion metrics per day Self-service deploys Zero downtime

Everything is monitored Code APIs for everything 136,000 deploys per day Very tiny two-pizza teams

$1 billion annual IT budget 80 deployments per week 17 billion API calls per month Self-service DevOps Dojo training

600 developers One code branch 20,000 tests per commit Every clean build deployed

Rix, M. (2019). Conquering the monolith: Architecting for DevOps and release on demand. SAFe Summit Europe, Hague, Netherlands.

38

Detailed DevOps economics starting to emerge ROI ranges from $17M to $195M with minor costs Benefits from cost savings, revenue, and availability

Forsgren, N., Humble, J., & Kim, G. (2017). Forecasting the value of devops transformations: Measuring roi of devops. Portland, OR: DevOps Research.Rico, D. F. (2017). Devops return on investment (ROI) calculator. Retrieved August 29, 2017, from http://davidfrico.com/devops-roi.xls

DevOps—Return on Investment

39

DevOps adoption growing fast in-spite of slow start 74% using, 14% thinking about it, & 12% are in-dark DevOps a global industry-wide extinction-level event

39Statistica. (2019). Extent of devops adoption by software developers worldwide in 2017 and 2018. Retrieved September 9, 2019, from https://www.statista.com/statistics/673505/worldwide-software-development-survey-devops-adoption

DevOps—Adoption Statistics

Never Heard of DevOps

3%Will NOT Use Devops

9%

Want to Use DevOps

14%

Started Using DevOps

22%Few Good DevOps

Teams21%

Many Teams Use DevOps

14%

Whole Firm Uses DevOps17%

40

Having a DevOps rollout strategy is a key to success Phased, incremental, and situational implementation Includes build, testing, & IT operations, & practices

St-Cyr, J. (2015). Evolving devops: Advance alm and devops practices with cont. imp. Agile Dev, Better Software, & DevOps East Conference, Orlando, Florida, USA.

DevOps—Roadmap

41

Containers, Ubuntu images, and pipelines are norm Fully automated testing and app security on the rise Future in DevOps Experience, BI DevOps, & AIOps

Bryant, D., et al. (2019). Devops and cloud infoq trends report. Retrieved September 9, 2019, from http://infoq.link/devops-trends-2019

DevOps—Trends

42Kim, G., Debois, P., Willis, J., & Humble, J. The devops handbook: How to create world-class agility, reliability, and security in technology organizations. Portland, OR: IT Revolution Press.

Everything begins with lean & agile principles Next step is smaller portfolio & simpler designs Final step is modular interfaces & E2E automation

DevOps—5 Keys to Success

DevOps DOES NOT mean deliver it now and fix it later Lightweight, yet disciplined approach to development Reduced cost, risk, & waste while improving quality

43Rico, D. F. (2012). What’s really happening in agile methods: Its principles revisited? Retrieved June 6, 2012, from http://davidfrico.com/agile-principles.pdfRico, D. F. (2012). The promises and pitfalls of agile methods. Retrieved February 6, 2013 from, http://davidfrico.com/agile-pros-cons.pdfRico, D. F. (2012). How do lean & agile intersect? Retrieved February 6, 2013, from http://davidfrico.com/agile-concept-model-3.pdf

What How ResultFlexibility Use lightweight, yet disciplined processes and artifacts Low work-in-processCustomer Involve customers early and often throughout development Early feedbackPrioritize Identify highest-priority, value-adding business needs Focus resourcesDescope Descope complex programs by an order of magnitude Simplify problem

Decompose Divide the remaining scope into smaller batches Manageable piecesIterate Implement pieces one at a time over long periods of time Diffuse risk

Leanness Architect and design the system one iteration at a time JIT waste-free designSwarm Implement each component in small cross-functional teams Knowledge transfer

Collaborate Use frequent informal communications as often as possible Efficient data transferTest Early Incrementally test each component as it is developed Early verificationTest Often Perform system-level regression testing every few minutes Early validation

Adapt Frequently identify optimal process and product solutions Improve performance

DevOps—Summary

44

DevOps ensures enterprise success by delivering large volumes of valuable, reliable, & secure IT products & services to billions of users in fractions of a second ...

DevOps—Bottom Line?

PMP, CSEP,EBAS, BAF, FCP,FCT, ACP, CSM,DEVOPS, AWS

& SAFE

39+ YEARSIN IT

INDUSTRY

45

Dave’s Professional Capabilities

STRENGTHS – Lean & Agile Thinking • Enterprise Transformation & Roadmapping • 360 Leadership Assessments • Executive & Agile Coaching • Enterprise Business Agility • Agile Acquisition Contracts • Scaled Agile Framework (SAFe) • Development Security Operations (DevSecOps) • Cloud Computing & Amazon Web Services (AWS) • Portfolio, Program, & Project Mgt. • Lean-Agile Product Management & Design Thinking • 5x5x5 Innovation & Marketing Sprints • Annual & Quarterly Strategic Planning • Technology & Product Roadmapping • Program Increment & Big Room Planning • Emergent & Evolutionary Microservices • Exploratory MVP, MVA, & MMF Experiments • Scrumban, Kanban & Lean-Agile Assessments • Performance Metrics, Measures & Dashboards • Agile lifecycle management (ALM) workflow tools ...

Economic Value of Agile Businesses, Enterprises & Organizations - http://davidfrico.com/value-of-business-agility.pdf